CVE-2018-7484

An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT Authority\SYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking.

• CWE-426

• http://www.defensecode.com/advisories/DC-2018-02-001-PureVPN-Windows-Privilege-Escalation.pdfThird Party Advisory
• https://www.securityfocus.com/archive/1/541803Third Party Advisory, VDB Entry
• http://www.defensecode.com/advisories/DC-2018-02-001-PureVPN-Windows-Privilege-Escalation.pdfThird Party Advisory
• https://www.securityfocus.com/archive/1/541803Third Party Advisory, VDB Entry

Published

Feb 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7475Cross-site scripting (XSS) vulnerability for webdav/ticket/ …6.1
• CVE-2018-7476controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cr…
• CVE-2018-7477SQL Injection exists in PHP Scripts Mall School Management S…
• CVE-2018-7479YzmCMS 3.6 allows remote attackers to discover the full path…5.3
• CVE-2018-7480The blkcg_init_queue function in block/blk-cgroup.c in the L…7.8
• CVE-2018-7482The K2 component 2.8.0 for Joomla! has Incorrect Access Cont…
• CVE-2018-7485The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c i…
• CVE-2018-7486Blue River Mura CMS before v7.0.7029 supports inline functio…
• CVE-2018-7487There is a heap-based buffer overflow in the LoadPCX functio…
• CVE-2018-7489FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.…
• CVE-2018-7490uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during …
• CVE-2018-7491In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking …